# CVE-2026-31431: Linux Local Privilege Escalation Actively Exploited by UMBRAL BISON Within 24 Hours of Disclosure

> CVE-2026-31431 ("Copy Fail"), a CVSS 7.8 Linux kernel local privilege escalation flaw in the algif_aead AEAD crypto template, was publicly disclosed with a working PoC on 2026-04-29 and exploited in the wild within roughly 20-24 hours by the Belarus-nexus adversary UMBRAL BISON (aka UNC1151/Ghostwriter). CrowdStrike's 2026 Threat Hunting Report assessed 94% of first-24-hour activity as PoC-based testing behavior, consistent with the report's broader finding that 88% of exploitation involving public PoC occurs within 48 hours of disclosure.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1831
- **ID:** TL-2026-1831
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UMBRAL BISON (Belarus)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-31431

## Description

CVE-2026-31431, nicknamed "Copy Fail" by researchers at Theori, is a logic flaw in the Linux kernel's cryptographic subsystem that was introduced by an in-place memory optimization merged in 2017 and only fully reverted in April 2026 (upstream commit a664bf3d603d, "crypto: algif_aead - Revert to operating out-of-place"). The kernel's algif_aead implementation reuses source memory as destination memory during AEAD cryptographic operations even though the source and destination come from different mappings. By chaining the AF_ALG socket interface with the splice() system call, an unprivileged local user can perform a controlled 4-byte write into the kernel page cache of any readable file — including setuid binaries such as /usr/bin/su — without ever writing to disk. Corrupting privilege-checking instructions inside a setuid binary's in-memory page allows the attacker to bypass access controls and spawn a root shell.

Unlike earlier Linux LPE bugs such as Dirty Cow and Dirty Pipe, Copy Fail does not require winning a race condition, making it deterministic and reliable across a very wide range of kernel builds. Virtually every mainstream Linux distribution shipping a kernel built between 2017 and the April 2026 patch is affected (Ubuntu, Debian, RHEL, SUSE/openSUSE, Fedora, Arch, Rocky Linux, AlmaLinux, Oracle Linux, Amazon Linux 2023, NixOS, Arista EOS), with NVD configuration data also flagging exposure in Siemens SIMATIC S7-1500 embedded Linux firmware. Because containers on a shared host frequently share a base-image kernel, the bug also enables container breakout and lateral movement across multi-tenant cloud and Kubernetes environments — CrowdStrike and Wiz both flagged the blast radius as touching a significant share of cloud Linux workloads and Kubernetes clusters.

Red Hat privately received the report on 2026-03-23; the upstream fix landed 2026-04-01; public disclosure with a working PoC and technical writeup followed on 2026-04-29, with a Metasploit module merged the same window (rapid7/metasploit-framework PR #21395) supporting AMD64 and AArch64 targets. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-05-01 with a federal remediation deadline of 2026-05-15. CrowdStrike OverWatch detected Belarus-nexus exploitation activity attributed to UMBRAL BISON "in just over 20 hours" after disclosure — the fastest adversary-attribution window discussed in the report — with roughly 94% of that first-day activity assessed as PoC-based testing rather than operational post-exploitation.

UMBRAL BISON (tracked elsewhere as UNC1151, FrostyNeighbor, UAC-0057, White Lynx, Storm-0257, TA445, and PUSHCHA, and publicly known as the Ghostwriter operation) is assessed by CrowdStrike as likely a Belarus-based, state-nexus adversary active since at least 2017 (previously the RepeatingUmbra cluster) that conducts intelligence-collection and enables information operations in support of Belarusian government interests, with a documented focus on Ukraine, Poland, and Lithuania. In related, previously reported Ghostwriter/UNC1151 activity (geofenced PDF-phishing campaigns against Ukrainian government/military and Polish industrial, healthcare, pharmaceutical, and logistics targets), the group used decoy documents impersonating Ukrtelecom, RAR archives containing JavaScript downloaders, and a PicassoLoader-to-Cobalt-Strike-Beacon delivery chain with server-side victim fingerprinting and manual operator validation before payload deployment. No malware, C2 infrastructure, or post-exploitation tooling specific to the UMBRAL BISON Copy Fail testing activity itself has been publicly disclosed by CrowdStrike; the actor's tradecraft documented here for the exploitation event is limited to rapid weaponization of the public PoC/Metasploit tooling.

Mitigation is available via kernel patch (all major vendors shipped fixed builds by early May 2026) or, where patching is not immediately possible, by blacklisting the algif_aead module (`install algif_aead /bin/false`), applying Red Hat's `initcall_blacklist` boot parameters, or blocking AF_ALG socket creation via seccomp in containerized environments.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.001 Malware
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1059.006 Python
- T1068 Exploitation for Privilege Escalation
- T1548.001 Setuid and Setgid
- T1211 Exploitation for Stealth
- T1055.009 Proc Memory
- T1611 Escape to Host
- T1036 Masquerading
- T1082 System Information Discovery
- T1613 Container and Resource Discovery
- T1105 Ingress Tool Transfer

## Sources

- [CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-threat-hunting-report/)
- [Umbral Bison Adversary Profile](https://www.crowdstrike.com/en-us/adversaries/umbral-bison/)
- [CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments](https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/)
- [Copy Fail: Universal Linux Local Privilege Escalation Vulnerability](https://www.wiz.io/blog/copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability)
- [NVD - CVE-2026-31431](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-31431)
- [RHSB-2026-002 Cryptographic Subsystem Privilege Escalation - Linux Kernel (CVE-2026-31431) - Copy Fail](https://access.redhat.com/security/vulnerabilities/RHSB-2026-002)
- [Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)](https://www.helpnetsecurity.com/2026/04/30/copyfail-linux-lpe-vulnerability-cve-2026-31431/)
- [Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability](https://discourse.ubuntu.com/t/fixes-available-for-cve-2026-31431-copy-fail-linux-kernel-local-privilege-escalation-vulnerability/81498)
- [CERT-EU - High Vulnerability in the Linux Kernel ("Copy Fail")](https://cert.europa.eu/publications/security-advisories/2026-005/)
- [Theori copy-fail-CVE-2026-31431 PoC exploit](https://github.com/theori-io/copy-fail-CVE-2026-31431)
- [Add exploit for CVE-2026-31431 (Copy Fail)](https://github.com/rapid7/metasploit-framework/pull/21395)
- [Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike](https://thehackernews.com/2026/05/ghostwriter-targets-ukrainian.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1831